CVE-2026-97249 in Paid Member Subscriptions Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within the Paid Memberships Pro plugin for WordPress, specifically affecting versions up to and including 3.0.9, represents a critical unauthenticated access bypass that undermines the core security model of membership-based websites. This software is widely used by organizations and individuals to restrict content behind paywalls or registration gates, making it a high-value target for attackers seeking unauthorized entry into protected areas. The flaw stems from insufficient validation of user authentication status during specific administrative operations, allowing any remote actor with network access to the targeted WordPress instance to execute privileged actions without providing valid credentials. This type of vulnerability is particularly dangerous because it bypasses the fundamental assumption that only authenticated users can modify site configuration or manage subscription tiers, effectively rendering the plugin's security controls obsolete for those affected endpoints.
From a technical perspective, this issue aligns with CWE-287, which describes Improper Authentication, and more specifically relates to CWE-306, the Missing Authentication for Critical Function. The root cause lies in the application logic failing to verify that the incoming request originates from an authenticated administrator session before processing sensitive requests related to subscription management or payment gateway configurations. In many WordPress plugins, certain AJAX endpoints or REST API routes are intended to be accessible only by users with specific capabilities such as manage_options or edit_posts. However, due to a coding oversight in version 3.0.9 and earlier, these checks were either absent or incorrectly implemented, allowing unauthenticated requests to pass through the initial security filters. This allows an attacker to manipulate subscription settings, alter pricing structures, or potentially access sensitive data associated with member accounts without ever logging into the WordPress dashboard.
The operational impact of this vulnerability is severe for any organization relying on Paid Memberships Pro to generate revenue or protect proprietary content. An unauthenticated attacker can exploit this flaw to disable payment gateways, effectively stopping all incoming subscriptions and causing immediate financial loss. Furthermore, by modifying subscription levels or access rules, an attacker could grant themselves or others elevated privileges within the application logic, potentially leading to full site compromise if combined with other vulnerabilities in the WordPress core or theme. The ability to bypass authentication also facilitates data exfiltration, as sensitive member information stored in the database may be accessible through manipulated queries that do not require proper session validation. This compromises both the confidentiality and integrity of the system, eroding trust among users who expect their personal and payment details to remain secure behind a paid subscription wall.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of bypassing authentication mechanisms to gain unauthorized access. It also relates to T1495, Elevated Execution with Client Binary Proxy or similar techniques where an attacker leverages legitimate application functionality for malicious purposes without proper authorization checks. The lack of input validation and session verification places this vulnerability in a high-risk category according to common scoring standards, as it requires no user interaction beyond sending a crafted HTTP request from any location on the internet. This ease of exploitation makes it attractive to automated scanning tools and script kiddies who routinely probe WordPress installations for known weaknesses in popular plugins like Paid Memberships Pro.
To mitigate this risk, immediate action is required by upgrading the plugin to version 3.0.10 or later, where these authentication checks have been properly enforced. Site administrators should verify that all other components of their WordPress environment are also up to date, as attackers often chain multiple vulnerabilities together for maximum impact. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by blocking suspicious request patterns associated with unauthenticated access attempts. Regular security audits and penetration testing focused on authentication flows in membership plugins are recommended to ensure that no similar logic flaws exist elsewhere in the application stack. Monitoring server logs for unusual activity related to subscription endpoints can also help detect exploitation attempts early, allowing for rapid incident response before significant damage occurs.